Fallout evaluation in an information system

Abstract

A method that includes receiving information system tickets, generating for each information system ticket a first state of data to capture an original state of one or more end-user operational data, generating for each information system ticket a second state of data to capture a changed state of the one or more end-user operational data, storing the first state and the second state in a database, and mining the database for changes in end-user operational data between the first state and the second state to generate patterns of changes. The patterns of changes are clustered into a number of clusters with each cluster representing a different ticketing issue.

1 . A computer-implemented method, comprising:
 generating, for each information system ticket of a plurality of information system tickets, a first state of data corresponding to at least an original state of one or more end-user operational data;   generating, for each information system ticket of the plurality of information system tickets, a second state of data corresponding to at least a changed state of the one or more end-user operational data;   storing the first state of data and the second state of data of the plurality of information system tickets in a database;   mining the database for changes in the one or more end-user operational data between the first state and the second state to generate patterns of changes;   clustering, via an unsupervised machine learning method, the patterns of changes into a plurality of clusters, wherein each cluster of the plurality of clusters represents a different ticketing issue associated with the plurality of information system tickets;   determining a new pattern of operational data changes related to a new ticket does not fit into the plurality of clusters;   detecting, based on the determining that the new pattern of operational data changes does not fit into the plurality of clusters, a new ticketing issue by assigning the new pattern of operational data changes to a new cluster; and   controlling execution of a mitigation action associated with the new ticketing issue by detecting the new pattern of operational data changes, that does not fit into the plurality of clusters, to exceed a predetermined threshold of occurrences.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising inferring information about an existing ticket of the plurality of information system tickets based on successfully assigning a pattern of operational data changes related to the existing ticket, to an existing cluster from the plurality of clusters. 
     
     
         3 - 5 . (canceled) 
     
     
         6 . The computer-implemented method of  claim 1 , wherein the detecting of the new ticketing issue is performed automatically. 
     
     
         7 . The computer-implemented method of  claim 1 , wherein the one or more end-user operational data comprises categorical data. 
     
     
         8 . The computer-implemented method of  claim 7 , further comprising converting the categorical data of the first state of data and the second state of data into a binary data prior to the mining of the database for the changes in the one or more end-user operational data. 
     
     
         9 . The computer-implemented method of  claim 1 , wherein:
 an information system ticket of the plurality of information system tickets is generated by an information system comprising one application; and   the database is mined for changes in the one or more end-user operational data between the first state of data corresponding to the one application and the second state of data corresponding to the one application.   
     
     
         10 . The computer-implemented method of  claim 1 , wherein:
 an information system ticket of the plurality of information system tickets is generated by an information system comprising at least two applications; and   the database is mined for changes in the one or more end-user operational data between the first state of data corresponding to a first application of the at least two applications and the second state of data corresponding to a second application of the at least two applications.   
     
     
         11 . (canceled) 
     
     
         12 . A computer program product, comprising:
 one or more computer-readable storage devices; and   program instructions stored on at least one of the one or more computer-readable storage devices to perform operations comprising:   generating, for each information system ticket of a plurality of information system tickets, a first state of data corresponding to at least an original state of one or more end-user operational data;   generating, for each information system ticket of the plurality of information system tickets, a second state of data corresponding to at least a changed state of the one or more end-user operational data;   storing the first state of data and the second state of data of the plurality of information system tickets in a database;   mining the database for changes in the one or more end-user operational data between the first state and the second state to generate patterns of changes;   clustering, via an unsupervised machine learning method, the patterns of changes into a plurality of clusters, wherein each cluster of the plurality of clusters represents a different ticketing issue associated with the plurality of information system tickets;   determining a new pattern of operational data changes related to a new ticket does not fit into the plurality of clusters;   detecting, based on the determination that the new pattern of operational data changes does not fit into the plurality of clusters, a new ticketing issue by assigning the new pattern of operational data changes to a new cluster; and   controlling execution of a mitigation action associated with the new ticketing issue by detecting the new pattern of operational data changes, that does not fit into the plurality of clusters, to exceed a predetermined threshold of occurrences.   
     
     
         13 . The computer program product of  claim 12 , wherein the operations further comprise:
 inferring information about an existing ticket of the plurality of information system tickets based on successfully assigning a pattern of operational data changes related to the existing ticket, to an existing cluster from the plurality of clusters.   
     
     
         14 . (canceled) 
     
     
         15 . The computer program product of  claim 12 , wherein the operations further comprise detecting the new ticketing issue automatically. 
     
     
         16 . The computer program product of  claim 12 , wherein the operations further comprise converting categorical data of the first state of data and the second state of data into binary data prior to the mining of the database for the changes in the one or more end-user operational data. 
     
     
         17 . A non-transitory computer readable storage medium tangibly embodying a computer readable program code having computer readable instructions that, when executed, causes a computer system to:
 generate, for each information system ticket of a plurality of information system tickets, a first state of data corresponding to at least an original state of one or more end-user operational data;   generate, for each information system ticket of the plurality of information system tickets, a second state of data corresponding to at least a changed state of the one or more end-user operational data;   store the first state of data and the second state of data of the plurality of information system tickets in a database;   mine the database for changes in the one or more end-user operational data between the first state and the second state to generate patterns of changes;   cluster, via an unsupervised machine learning method, the patterns of changes into a plurality of clusters, wherein each cluster of the plurality of clusters represents a different ticketing issue associated with the plurality of information system tickets;   determine a new pattern of operational data changes related to a new ticket does not fit into the plurality of clusters;   detect, based on the determination that the new pattern of operational data changes does not fit into the plurality of clusters, a new ticketing issue by assignment of the new pattern of operational data changes to a new cluster; and   control execution of a mitigation action associated with the new ticketing issue by detection of the new pattern of operational data changes, that does not fit into the plurality of clusters, to exceed a predetermined threshold of occurrences.   
     
     
         18 . The non-transitory computer readable storage medium of  claim 17 , wherein the computer readable instructions further cause the computer system to:
 infer information about an existing ticket of the plurality of information system tickets based on successfully assigning a pattern of operational data changes related to the existing ticket to an existing cluster from the plurality of clusters.   
     
     
         19 . (canceled) 
     
     
         20 . The non-transitory computer readable storage medium of  claim 17 , wherein the computer readable instructions further cause the computer system to:
 convert categorical data of the first state of data and the second state of data into binary data prior to the mining of the database for the changes in the one or more end-user operational data.